On Wed, Oct 09, 2019 at 01:41:40PM -0500, Matthew Grooms wrote: > On 10/9/2019 4:10 AM, Julien Cigar wrote: > > On Tue, Oct 08, 2019 at 11:22:51AM -0500, Matthew Grooms wrote: > >> On 10/8/2019 10:58 AM, Julien Cigar wrote: > >>> On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote: > >>>> Hi Julien, > >>> Hi Matthew, > >>> > >>>> It's not clear why you are trying to assign multiple carp IP address to > >>>> two different interfaces from within the same IP subnet. Are you trying > >>>> to fail over a 2nd carp address or are you trying to improve > >>>> throughput/redundancy? If you just want to fail over a 2nd carp address, > >>>> assign a 2nd alias to your first interface. If your trying to improve > >>>> throughput/redundancy, assign both interfaces to a lagg and build your > >>>> carp interfaces on top of that instead. > >>>> > >>> Currently outbound traffic from $net1 and $net2 (two private networks) > >>> pass through the same network interface (igb0) (as you can see in (1) > >>> in my previous post) on the router. I'd like to prevent that > >>> $net2 saturates the interface and slow down traffic from $net1 (which is > >>> more important). I could lagg and build CARP on top of that but it > >>> wouldn't prevent $net2 to saturate the interface (unless I'm plugin ALTQ > >>> of course, which I'd like to avoid). > >> Well, I'm not sure how well it will work but I think what you are > >> looking for is the route-to pf rule option. You can specify that certain > >> traffic be transmitted via a specific network interface to a specific > >> next hop. However, I believe you'll need to match traffic as it's > >> received on the internal interface, ie. before the kernel determines the > >> egress interface. > >> > >> table internal_networks { $net1, $net2 } > >> pass in on $internal_interface route-to( igb0 $default_gw ) from $net1 > >> to !<internal_networks> > >> pass in on $internal_interface route-to( igb1 $default_gw ) from $net2 > >> to !<internal_networks> > > Thanks, I haven't used the route-to yet but if I understand well it's > > a way to "bypass" the default route/interface? > > Yes. It's essentially pf's way of providing policy based routing in the > rule set.
Excellent, it looks exactly what I need Thanks! > > -Matthew > -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced.
signature.asc
Description: PGP signature